ICA Proxy for XenApp using NetScaler AGEE.

Citrix NetScaler, a member of the Citrix Delivery Center™, is a purpose-built web application delivery solution that accelerates application performance up to five times while improving security and reducing web infrastructure costs. Access Gateway™, a member of the Citrix Delivery Center, is an only SSL VPN to securely deliver any application with policy-based SmartAccess control. Access Gateway, Enterprise Edition (AGEE) runs on the Citrix NetScaler.

Citrix XenApp™, also a member of the Citrix Delivery Center™ product family, is the industry's de facto standard for delivering Windows-based applications with the best performance, security and cost savings.

By centralizing applications and data in secure datacenters, IT can reduce the costs of management and support, increase data security and facilitate business continuity.

We at Citrix are often asked how to deploy a NetScaler AGEE in front of a XenApp server farm, to proxy application delivery over the ICA protocol, securely. The NS SGEE secures XenApp delivered applications by serving as a proxy for those applications. NS AGEE proxies the ICA connections delivered from XenApp, and then wraps those applications with HTTPS or SSL to secure the traffic before it leaves your organization.

This is possible by following the steps in the deployment guide. This guide is specific to the NetScaler Access Gateway Enterprise Edition (AGEE), which is different hardware & software from the Citrix Access Gateway Standard Edition (AGSE).

Download the deployment guide.

Its Powerful Citrix Developer Network!

PinSafe is a form of multi-factor authentication which is easier to deploy and more cost effective than its token based competitors.  It also integrates seamlessly with the NetScaler for both SSL VPN and AAA for Web Applications.

It works by providing the user a customized "one time" image on the login page.  The image employs character rotation and will use a range of fonts and backgrounds to provide resistance to OCR attacks.  Contained within the image, is a security string which can be made up of numbers, characters or even a mixture of the two.   Place holders in the image help the user to extract their one-time image code.  So in the example below, a PIN of 4359 would yield a one-time code of 3125.

The default image has place holders to help the user extract the one-time code, but other, pattern based images can also be used.  The examples below show the numeric (eg telephone) keypad pattern as well as a more random pattern.  These images can even be branded for individual customers requirements.

For more information goto http://www.swivelsecure.com/

Everyone should know by now that the NetScaler standard is the best practice for XenApp delivery.  So why do folks still see "Access Gateway" on the NetScaler's cool carbon fiber login page?

Do your prospects a favor and provide a consistent message that NetScaler is the solution they are testing! 

One small way you can address this is by changing the "Access Gateway" graphic in the VPN login page to read "NetScaler".   I bet you didn't even know Citrix already put the logo on the device, did you?

Proceedure

1. Log in to the command line interface using any of the available methods:
   1. Web GUI: System > Diagnostics > Command Line Interface
   2. Console port 
   3. SSH client
2. Issue the following commands:

> shell
# cp -r /netscaler/ns_gui/vpn/* /var/vpn/vpn
# cd /var/vpn/vpn/images
# mv ctxHeader01.gif ctxHeader01ForAGEE.gif
# cp ctxHeader01ForTM.gif ctxHeader01.gif

Notes

 Used NetScaler 9.0